Pharos Blueprint Enterprise 5.3 Update 3

This update should be applied to all machines hosting Blueprint components, i.e. the Analyst, Collector, Administrator. The components included in this update:

THe Print Scout package should be distributed to all Workstations where Serverless Printing feature will be used.

What's new in 5.3 - Update 3

• CNAME support in Sentry Print Service SSL Certificate.

• Blueprint now supports MobilePrint version 2.4.

• Added health test for IPP Service.

• The Blueprint Administrator now shows the update version.

• Sentry Print terminal is now deleted from the database when device is unsecured.

• New Touchless Printing, including QR codes, iOS & Android apps, and proximity cards for job release.

• Sentry Print extends support for new models from Hewlett-Packard, Konica Minolta, Ricoh, and Xerox.

• "HP Secure Print Service" renamed to "Pharos Systems Sentry Print Service".

• "Pharos Universal Printing Service" renamed to "Pharos IPP Service".

• The page Counter for Secure Release has been updated to version 10.0.9995.1

• Requires minimum .Net Core 2.1.23 and .Net Core 3.1.8.

Note: Refer to the Blueprint New Features Guide in the Pharos Community for more information about new features, improvements, and bug fixes in Blueprint 5.3 Update 3.

What's new in Print Scout 7.21.11.1

• Print Scout can now install the Pharos IPP printer driver on Windows 10 for print job delivery.

• The Electron version used for running the Scout User Interface has been upgraded to 7.1.1.

Limitations

• If "Integrated Security" is used to connect to MS SQL, the Print Center won't work after applying this release. To fix, set the Pharos ASP.NET v4.0 App Pool in IIS to use an account that has MS SQL permissions. Refer to the "New Features" document in the Pharos Community for more information.

Integrations

MobilePrint

MobilePrint is NOT affected by applying this update. Also, MobilePrint installed AFTER update is applied will work with no further configuration changes. MobilePrint 2.2.1 does not support TLS 1.2 and will not work if TLS 1.2 is the only cipher suite enabled. The latest version of MobilePrint 2.3 has full support for TLS 1.2.

Other

Updated versions of the following integrations are included in this update.

• Apple Airprint

• MobilePrint

• Pharos Print Center

• VPSX

VPSX and HP ePrint Integration

• Any previously installed version of these Integrations will stop working once the update is applied.

• After applying this update, you will need to re-install the integration using the version included with this Update. i.e. replace the deployed DLLs with the new versions.

• If TLS 1.2 is the ONLY cipher suite enabled the VPSX SRH integration will not work.

How to Apply This Update

Warning: Blocked Files

Depending on how this update or its files were copied to the target machine, some of the files may have been 'blocked' by Windows. Trying to update a Blueprint component with a blocked file will most likely prevent that component from working correctly. To check whether a file is blocked and/or unblock it, right-click the file in Windows Explorer and select 'Properties'.

Warning: In use Files

Under some conditions, the upgrader may be unable to replace files because they are in use. If this happens,

1. Stop IIS using the command line 'iisreset /stop'

2. Run the upgrade again.

3. Start IIS using the command line 'iisreset /start'

Updating Analyst or Collector

Installation Steps

1. If updating Analyst, make sure you have an up to date backup of the psbprint database.

2. Close the Window's Printers window (if it is open). Close any Pharos applications (e.g. Troubleshooter, Blueprint Administrator) that are open.
    Note: you do not need to stop the Pharos Services. The update installer will do this automatically.

3. Open an elevated Windows command prompt and run Patcher.exefrom the command line. No additional parameters are necessary.

   • The update installer does not create a log file. It is recommended that you run DebugView (http://technet.microsoft.com/en-us/sysinternals/bb896647) to capture the output of the installer. This output will include error messages if the installer fails.

   • Also, the existing Blueprint files will be backed up to BP53 in the Temp directory, before they're replaced with the updated versions.

   • If the update installer fails, you can correct the cause of the error and run Patcher.exe again.

   • At completion, the Patcher may automatically force a restart. Follow the remaining instructions after the restart.

   • To log the installation of MSI files associated with the update, edit <MsiLogFileDirectory> in the Patcher.xml file with a folder path.

4. On Analyst, open the Blueprint Analyst, go to Reporting -> Publications and click on "Publish to Data Warehouse" on the toolbar.

Automated Deployment to Collectors

Customers with a large number of Collectors may want to deploy this update using an automated software deployment tool (e.g. IBM's Tivoli).

To help with this process, the Patcher can be configured to send an e-mail at the end of the patching process indicating the patching attempt's success or failure. The configuration is held in the file Patcher.xml. Modify the file as follows:

1. Change the <automated> element from "false" to "true".

2. Set "to" to the e-mail address you want the notification sent to.

3. Set "from" to the e-mail address you want the notification to claim it was sent from.

4. Set smtpServerHost to the FQDN of the mail server.

5. Leave smtpServerPort alone, unless the mail server is using a non-standard port. Or you want the communication encrypted using SSL.

6. If the mail server and its Host are configured to support SSL, you can change useSSL to "true" and smtpServerPort to the SSL port (usually 465).

7. Set smtpUserName and smtpPassword to the user and password needed to use the mail server.

8. If you do not want to put an unencrypted password in the Patcher.xml file, you can put the password as encrypted text into smtpEncryptedPassword. You can encrypt the password by calling Patcher.exe from the command line with the flag "/encrypt:". e.g. Assume your mail server's password is "MySecretPassword".

   1. Open a command prompt and type in patcher /encrypt:MySecretPassword

   2. Patcher.exe will return EncryptedPassword:L9EMZX9r1CkvI8rNybP/dikf09zwBPLMfl6OMk7/nXOCgZQpaePQDoGDULN3eAbe"

   3. Set smtpEncryptedPassword="L9EMZX9r1CkvI8rNybP/dikf09zwBPLMfl6OMk7/nXOCgZQpaePQDoGDULN3eAbe"

9. If your deployment tool will run the patcher under an account that has permission to send e-mails, then you can set useDefaultCredentials to "true" and leave smtpUserName, smtpEncryptedPassword and smtpPassword blank.

Updating standalone installations of the Blueprint Administrator

If Workstation Tracker is installed along with the Blueprint Administrator, applying the update will NOT update the Tracker.

1. Close the Window's Printers window (if it is open).

2. Open an elevated Windows command prompt and run Patcher.exe from the command line. No additional parameters are necessary.
   Note: The update installer does not create a log file. It is recommended that you run DebugView (http://technet.microsoft.com/en-us/sysinternals/bb896647) to capture the output of the installer. This output will include error messages if the installer fails.

3. A reboot might be required after the update is run. This is done automatically so make sure you save any open files prior to applying the update.

4. If the update installer fails, you can correct the cause of the error and run Patcher.exe again. Alternatively, you can contact Pharos for manual upgrade instructions.

Updating Tracker on Print Servers

On all the Windows Print Servers where tracking is required, use the Blueprint Print Scout package contained in the Tracker directory to install or upgrade the Tracker.

Updating Tracker on Windows Workstations

Print Scout packages should be distributed to all workstations hosting the Blueprint Tracker, so you can take advantage of the new features and improvements.

Updates to Blueprint Enterprise 5.3 Prior to Update 3

• Microsoft Silverlight dependency has been removed from Blueprint.

• Print Center Improvements:

  • Finer grain control of which users can release jobs from Print Center.

  • Assorted security improvements.

  • Administration Roles can be granted to SSO logons.

  • Print Center can be installed on Server without needing the rest of BP Collector components.

• Delegate Printing Improvements:

  • Better control of how to search for delegates in Active Directory.

  • Support for delegate search using LDAP.

  • Can disable sending email notifications when a print job with delegates is submitted or released.

  • Users don't have to change Delegate settings to "Automatically Assign" when creating delegates.

• Distribution Lists can be used for Permissions/Policy.

• Quotas have been largely re-written. Refer to the Blueprint New Features Guide for information on what's changed in Quota Management.

• Print Scout - /NoCertificate option added. When set, the Pharos CA certificate is not installed.

• Option to hash the names of all Print Jobs that a Collector stores in the database.

• New Health test showing the number of Web Sockets in use.

• Applying Update no longer stops logging of Sentry Print services.

• The new Pharos IPP Service allows job submission to Secure Release Here via iOS App, macOS, and Linux. Refer the to the Pharos Universal Printing Service Technote in the Community.

• Removed the ability to submit jobs via AirPrint. Replaced by the Pharos IPP Service.

• Improvements to Pharos Sentry Print:

  • Database Off-line support.

  • Support for some HP iMFP models.

  • Sentry Print iMFPs can be assigned to a different Collector without needing to uninstall the Sentry Print app from the iMFP first.

  • Devices with no IP address in the Blueprint database can no longer be secured.

  • Sentry Print supports "Pull Print" release mode for print jobs.

    • Turn on by setting <UsePullPrint> in GlobalConfig.xml to true

    • Add <PullPrintFqdn> entry to file below the UsePullPrint to specify the HostName to use for the Collector from outside the company firewall.

• Option to identify delegates using an email address instead of a network name where network id is considered sensitive.

• Improvements to LDAP directory search for Groups - Now matched to Active Directory group search.

• Patcher correctly updates DatabaseVersion table.

• Requires .Net Core 2.1.23 and .Net Core 3.1.3.

• Fixed issue with SRH service becoming unresponsive when unable to establish Websockets for Serverless printing.

• New Logon Roles (e.g. "Manage Devices", "Manage Event Log") have been added.

• Audit Log of logons by administrative staff.

• New Health test that sends warning 30 days before Blueprint license is due to end.

• Email + PIN authentication.